Is CVE-2026-19769 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-19769 being exploited in the wild.

How severe is CVE-2026-19769?

High severity, with a CVSS score of 7.2, published 5 September 2026.

Which products and versions are affected?

Ninja Forms – The Contact Form Builder That Grows With You up to and including 3.15.1.

Is there a fix for CVE-2026-19769?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-19769 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-19769?

Check whether you run Ninja Forms – The Contact Form Builder That Grows With You at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-19769: Ninja Forms stored XSS via repeater type confusion

CVE-2026-19769 · Severity: high · CVSS 7.2 · Published 2026-09-05

Ninja Forms is a popular WordPress plugin for building contact forms. The plugin contains a stored cross-site scripting (XSS) vulnerability that allows unauthenticated attackers to inject malicious scripts into web pages. When users visit pages containing the injected script, it executes in their browsers, potentially allowing attackers to steal credentials, deface content, or compromise website visitors.

Vendors: Ninja Forms.

Quick answers

Is CVE-2026-19769 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-19769 being exploited in the wild.
How severe is CVE-2026-19769?: High severity, with a CVSS score of 7.2, published 5 September 2026.
Which products and versions are affected?: Ninja Forms – The Contact Form Builder That Grows With You up to and including 3.15.1.
Is there a fix for CVE-2026-19769?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-19769 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-19769?: Check whether you run Ninja Forms – The Contact Form Builder That Grows With You at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in Ninja Forms versions up to 3.15.1 due to insufficient input sanitization and output escaping of the Repeater Child 'type' parameter. An attacker exploits a type confusion in unmatched array keys to inject arbitrary HTML/JavaScript. The attack requires the Ninja Forms File Uploads add-on to be active, as the attacker routes an unwhitelisted child entry through the File Uploads handler to write attacker-supplied HTML files containing arbitrary JavaScript to web-server-writable directories such as the site root. The malicious file is then served from the site's own origin, executing within the security context of the vulnerable site. The vulnerability is unauthenticated and requires no user interaction beyond a victim visiting an affected page. Patches are available in versions after 3.15.1.

Affected products

Ninja Forms Ninja Forms – The Contact Form Builder That Grows With You up to and including 3.15.1

Timeline

2026-09-05: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.